{"id":"CVE-2026-108014","kind":"vulnerability","aliases":["CVE-2026-108014"],"related":[],"title":"HCL Domino: compromised eMudhra CA keys let attackers spoof TLS servers","description":"Private keys for eight eMudhra intermediate CA certificates have been  compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.","summary":"Private keys for eight eMudhra intermediate CA certificates were compromised, so the certificates no longer protect trust. An unauthenticated network attacker can use them to impersonate servers and intercept or modify outbound TLS connections from HCL Domino Server.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["certificates","hcl-domino","self-hosted","tls","vendor"],"not_affected_if":["no-emudhra-trust","no-outbound-requests"],"how_to_check":"- Confirm whether the HCL Domino Server runs outbound network request features that rely on the trusted CA store, using the server's own configuration (unknown if the sources give a specific setting)\n- Check whether eMudhra intermediate CA certificates are present in the trust store used by Domino, for example by listing the issuer chain of outbound connections (unknown if the sources give a command)","fix":"- Follow the HCL and eMudhra advisories for the affected certificates and the fixed HCL Domino release (unknown: the sources do not name versions)\n- Remove or distrust the eight compromised eMudhra intermediate CA certificates from the Domino trust store once the vendor instructs it (unknown: the sources do not give the exact steps)","status":"open","published_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:19+00:00","updated_at":"2026-10-27T17:34:19+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-27T17:34:19Z","model":"claude-haiku-5-5","output":{"fix":"- Follow the HCL and eMudhra advisories for the affected certificates and the fixed HCL Domino release (unknown: the sources do not name versions)\n- Remove or distrust the eight compromised eMudhra intermediate CA certificates from the Domino trust store once the vendor instructs it (unknown: the sources do not give the exact steps)","reach":"network","title":"HCL Domino: compromised eMudhra CA keys let attackers spoof TLS servers","impact":"high","summary":"Private keys for eight eMudhra intermediate CA certificates were compromised, so the certificates no longer protect trust. An unauthenticated network attacker can use them to impersonate servers and intercept or modify outbound TLS connections from HCL Domino Server.","category":"vendor","nicknames":[],"who_cares":["hcl-domino","self-hosted","tls","certificates"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker impersonates servers and reads or alters outbound TLS traffic.","analyst_note":"Read the eMudhra advisory at https://emudhra.we-have-a-problem.com/ and the HCL Domino security bulletin for affected versions, fixed releases and trust store steps.","how_to_check":"- Confirm whether the HCL Domino Server runs outbound network request features that rely on the trusted CA store, using the server's own configuration (unknown if the sources give a specific setting)\n- Check whether eMudhra intermediate CA certificates are present in the trust store used by Domino, for example by listing the issuer chain of outbound connections (unknown if the sources give a command)","needs_analyst":true,"not_affected_if":["no-outbound-requests","no-emudhra-trust"],"who_is_affected":"Teams running HCL Domino Server with outbound network request features that validate TLS certificates chained to the compromised eMudhra intermediate CAs. Systems that make no outbound TLS connections through Domino, or that do not trust eMudhra chains, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000696,"input_tokens":3342,"output_tokens":724,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-108014':14A,17A '-2026':13A,16A 'and/or':111C 'attack':8A,47B,93C,106C 'ca':5A,33B,71C 'certif':18B,34B,39B,72C,79C,97C 'compromis':3A,36B,75C 'connect':60B,118C 'content':114C 'could':94C 'cve':12A,15A 'domino':2A,21B,63B,88C 'eight':30B,68C 'emudhra':4A,31B,69C 'emudhra.we-have-a-problem.com':76C 'enabl':107C 'execut':99C 'featur':85C 'hcl':1A,20B,62B,87C 'hcl-domino':19B 'host':24B 'impact':78C 'imperson':52B 'intercept':55B,110C 'intermedi':32B,70C 'key':6A,28B,66C 'let':7A 'longer':41B 'man':101C 'middl':104C 'mitm':105C 'modifi':57B,112C 'network':46B,83C,92C 'outbound':58B,82C,116C 'privat':27B,65C 'protect':42B 'request':84C 'self':23B 'self-host':22B 'server':11A,53B,64B,89C,96C 'spoof':9A,95C 'tls':10A,25B,59B,117C 'trust':43B,80C 'unauthent':45B,91C 'use':49B 'vendor':26B","nicknames":[],"mitigations":[],"who_affected":"Teams running HCL Domino Server with outbound network request features that validate TLS certificates chained to the compromised eMudhra intermediate CAs. Systems that make no outbound TLS connections through Domino, or that do not trust eMudhra chains, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108014","severity":null,"published_at":"2026-10-27T17:16:57+00:00","modified_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}